Security update 5.8.1 and file upload

Recently our server was compromised with a number of GIF files containing malware.
According to our service provider, the attack vector was "POST /index.php?option=com_eventbooking&task=upload_file&format=raw HTTP/1.1"
Where the files were placed in directory media/com_eventbooking/filesUnfortunately we were still on version 5.7.0. Meanwhile we upgraded to 5.8.1.

Question: Is 5.8.1 now secure against these types of uploads?

Thanks for answering,
Regards, Frans

Hi Frans

- If you do not use File custom field, then Yes, uploads won't be processed anymore. No need to worry about.


- If you use File custom field, there is no way block these kind of uploads. For example, someone can still upload .txt files to the folder. The type of file can be uploaded is controlled by Attachment File Types config option in Events Booking. There are protections added to reject files containing malware, so if it is normal files, it can be uploaded, but if it is malicious files, it will be blocked.
- You can use this hidden tool docs.joomdonation.com/eventsbooking/tools#remove-orphan-files to delete the files which were uploaded before and not associated to any registration records
- If you use File custom field type, and worry about the files uploaded by attackers, you can setup scheduled task to delete these files automatically, see docs.joomdonation.com/eventsbooking/sche.../delete-orphan-files

Regards,

Tuan